Have project that has 3 affiliates each with OnPrem AD (single domain forest) moving to Office365 and they would like everyone to have a common Office 365 logon domain.
So on-prem domains (e.g.: aaa.affiliateA.org, bbb.affiliateB.org, ccc.affilateC.org) and NEED (hard requirement) everyone to have Office 365 cloud exchange e-mails of (user@affiliategroup.org)
No existing trust or vpn between the affiliate offices. None of the affiliates coming from existing 365 exchange online or on-prem exchange.
Just discovered the existence of "Azure Active Directory Connect cloud sync" - lightweight sync agent (vs. Azure AD connect - full sync solution)
Reviewed:
Azure AD Connect cloud sync video
and
Cloud Sync Docs
(1)
How can I insure “ms-dir-consistencyGUID” would be used for a source anchor and not the “fallback” ObjectGUID.?
FAQ’s state:
By default, cloud sync uses ms-ds-consistency-GUID with a fallback to ObjectGUID as source anchor. There is no supported way to change the source anchor.
- and -
No, cloud sync does not support writeback of ms-ds-consistencyGUID for any object (including user objects).
Expecting it would be likely that we would need move a user from one ad forest to another in the future (aaa\user1 moves to bbb\user1) – so expecting we would need to be able to create on-prem bbb\user1 and copy over the “ms-dir-consistencyGUID” from aaa\user.
(2)
I also want to be sure that if I do sync these 3 AD's with "Cloud sync" I'm not "cutting off" a path of loading the Full "Azure AD Connect" later on if I needed it for Hybrid Device join. Would expect to use "ms-dir-consistencyGUID" in order to facilitate the ability to move users from one forest to another if needed. Documents seem to cover a case where you already have Azure AD Connect (full sync soln) in place and you then want to change rules to use Azure AD Connect cloud provisioning agent for User/contact/group objects. But I didn't see mention of going the other way around where you start with AD cloud provision and the need to add in "Azure AD Connect" later on.
@Daniel Birmingham - Hoping you are the Daniel Birmingham from you tube "Accelerate your hybrid identity journey with Azure Active Directory"
@Bill Mathers